Recommendations Tracker

We recommend that the Administration for Strategic Preparedness and Response provide technical assistance or education to the new contractor regarding novation procedures.

We recommend that the Administration for Strategic Preparedness and Response correct the Recording Statute violation for the contract that was not properly finalized by ratifying the original contract and properly recording an obligation.

We recommend that the Administration for Strategic Preparedness and Response create policies and procedures for the maintenance and organization of electronic contract files.

We recommend that Independent Health Association, Inc. identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before and after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that HHS require OpDivs to implement a cybersecurity risk management strategy to assess and respond to identified risks within the agency, watch for new risks, and monitor risks and confirm implementation. The strategy should define a standardized process to accept and monitor risks that cannot be adequately mitigated.

We recommend that HHS require OpDivs to implement an effective SCRM program that meets the defined standards across HHS and confirm implementation is consistent with established standard. HHS should ensure that all OpDivs are appropriately assessing vendors and submitting data points to assist with tracking and monitoring components on the network.

We recommend that the HHS OCIO monitor and confirm that the OpDivs conduct an annual review of the System Security & Privacy Plan and annually perform risk assessments for all operational systems, according to organizational policy.

We recommend that the HHS OCIO monitor and confirm that the OpDivs perform the SAR and ATO in accordance with the organization's policy.

We recommend that the HHS OCIO confirm OpDivs define and implement an OpDiv level supply chain risk management strategy based on HHS departmental policy and NIST standards.

We recommend that the HHS OCIO ensure that all OpDivs' baseline configurations are documented and tracked for each system in the OpDiv.

We recommend that the HHS OCIO ensure that all OpDivs acquire the resources to fully implement MFA or an alternative strong authentication and implement multi-factor authentication or an alternative strong authentication for both privileged and non-privileged users on all operational systems.

We recommend that the HHS OCIO ensure that all OpDivs are properly implementing remote session timeouts of 30 minutes (or less) for operating systems.

We recommend that the HHS OCIO ensure that all OpDivs' operational systems have an approved and up-to-date PIA in accordance with the HHS Policy of Privacy Impact Assessment.

We recommend that the HHS OCIO require and confirm that all OpDivs have a process in place to evaluate their workforce gaps. Furthermore, confirm that all OpDivs are implementing a compliant security training strategy as defined by overarching HHS policy.

We recommend that the HHS OCIO continuously monitor to ensure that all OpDivs inherit and consistently implement policies or procedures to govern their incident response strategy.

We recommend that the HHS OCIO work with the OpDivs to require and confirm that all OpDivs' operational systems have a complete and up-to-date BIA.

We recommend that the HHS OCIO work with the OpDivs to confirm that all OpDivs' policies and procedures covering Contingency Plan testing are in accordance with policy requirements by Departmental policy, NIST standards, and OMB guidance.

We recommend that the National Institutes of Health facilitate timely unilateral closeout within 1 year of the PPE date by implementing a policy that requires the unilateral closeout process be completed early enough to allow for final closeout within 1 year of the PPE date; and providing additional training to staff involved in the closeout process to increase staff awareness (i.e., sending monitoring reports to ICs for awards eligible for unilateral closeout).

We recommend that the National Institutes of Health retroactively report all recipients with unilateral closeout actions in calendar year 2023 in SAM.gov.

ACF should help States to improve their abilities to monitor patterns of maltreatment and performance across chains of residential facilities operating in multiple States.

ACF should work with States to improve reporting of placement data in NCANDS.

We recommend that the North Carolina Department of Health and Human Services strengthen internal controls by expanding written policies and procedures to include procedures for requesting, recording, and reporting all MFCU-determined Medicaid overpayments within prescribed regulatory timeframes, and ensuring they received all case files.

We recommend that the National Institutes of Health incorporate, by reference, the administrative closeout requirements from the FAR and HHSCCD into the NIH Policy Manual.

We recommend that the National Institutes of Health establish control activities for monitoring the performance of contract personnel's compliance with administrative closeout requirements.

To strengthen program safeguards for preventing and detecting improper payments for short inpatient stays and recovering overpayments for claims that do not comply with Medicare requirements, we recommend that the Centers for Medicare & Medicaid Services work with its contractors to develop a list of ICD-10 procedure codes associated with the HCPCS codes on the inpatient only procedures list.

To strengthen program safeguards for preventing and detecting improper payments for short inpatient stays and recovering overpayments for claims that do not comply with Medicare requirements, we recommend that the Centers for Medicare & Medicaid Services work with its contractors to update policies and procedures for postpayment reviews to focus on claims for short inpatient stays identified as at risk for noncompliance with the two-midnight rule and recovery of overpayments (e.g., through additional reviews by RACs or other contractors).

We recommend that the Food and Drug Administration develop and implement policies and procedures requiring periodic reporting (e.g.,monthly reporting) to senior leadership on the status of open whistleblower complaints.

We recommend that the Food and Drug Administration strengthen the QFC process to identify data entry inaccuracies.

We recommend that the Food and Drug Administration develop policies and procedures that FDA can use during future public health emergencies to identify how and when it is necessary to conduct mission-critical inspections and ensure that mission-critical inspections are conducted in a timely manner.

We recommend that the Food and Drug Administration amend the language on the CAERS adverse event report form to emphasize the importance of including the lot number to encourage the public to report this information.

We recommend that the Centers for Medicare & Medicaid Services identify providers who ordered OTS braces for enrollees with whom they had no treating relationships and use that information to determine whether to provide additional education to—or take administrative or legal action against—the ordering providers or associated suppliers.

We recommend that the Centers for Medicare and Medicaid Services review Medicare allowable amounts for OTS braces that are not currently in the DMEPOS Competitive Bidding Program to ensure that Medicare payments for OTS braces are reasonably comparable with payments made by non-Medicare payers, and determine whether to include any of those procedure codes for braces in future rounds of competitive bidding.

We recommend that the Centers for Medicare & Medicaid Services use predictive data analysis and information from other Federal agencies and from State agencies to identify emerging fraud schemes related to OTS braces, and use CMS's authority to prevent further losses to the Medicare program.

We recommend that the Centers for Disease Control and Prevention require the six recipients in our sample that may have improperly charged salary, related fringe benefit, and overhead costs to the REACH program award to refund $1,377,025 to the Federal Government or work with the recipients to determine what portion of these costs is allocable to their REACH program award and refund any unallocable portion of these costs to the Federal Government.

We recommend that the California Department of Health Care Services work with CMS to determine the amount of any improperly claimed Federal reimbursement for capitation payments made on behalf of noncitizens with UIS for an agreed-upon period not covered by our audit.

We recommend that HHS continue advocating for legislative changes and work with OMB and other stakeholders to develop and implement an approach to calculating and reporting on TANF IPs going forward. This process will aid in identifying root causes of TANF IPs and allow HHS to report CAPs in the AFR.

We recommend that HHS focus on the root causes of the IP percentage and evaluate critical and feasible action steps to assist states with their compliance efforts for these requirements. This would include working with the states to bring their respective systems into full compliance with the requirements to decrease the IP rate percentage below 10 percent. HHS should work with the states to follow up on repeat root causes of errors and enhance the CAPs for implementation. In addition, as HHS reviews only 17 states each year for the CHIP IP rate, HHS should continue to follow up with states during the interim period to verify that corrective actions identified after the Payment Error Rate Measurement (PERM) review are being implemented. HHS should also consider sharing corrective action best practices across states to help address these issues. Additionally, HHS should continue to focus on corrective actions around eligibility as there is an increased risk that the rates for Medicaid

We recommend that HHS continue to work with OMB and other relevant stakeholders to complete the IP measurement program for the State-based Exchanges to report a full and accurate IP estimate.

We recommend that HHS should include in its UIP estimation methodology an evaluation of patient eligibility and consider alternative methods to perform this evaluation if data limitations exist.

CMS should provide additional technical assistance to States to clarify what to include or exclude from the reported paid amounts to providers for Medicaid managed care drug claims.

NIH should develop additional ways of supporting researchers in meeting inclusion enrollment targets.

We recommend that the Colorado Department of Health Care Policy and Financing determine the value of overpayments identified after our audit period that have been recovered and collected but not reported, report them on the Form CMS-64, and refund the Federal share of the recovered overpayments.

We recommend that the Colorado Department of Health Care Policy and Financing strengthen policies and procedures to ensure that overpayments are reported correctly and in a timely manner on the Form CMS-64 in accordance with Federal requirements.

We recommend that New York Medical College refund $73,515 in unallowable salary costs, cost transfers, and travel costs.

We recommend that New York Medical College strengthen its internal controls by developing a policy or procedure that requires compensation costs to be reasonable, conform to established College policy, and be consistently applied regardless of the source of the funds and that reasonably reflects the percentage of time actually devoted to its NIH-funded projects.

We recommend that New York Medical College strengthen its internal controls completing the timely certification of employee time and effort reports to provide reasonable assurance that the charges are accurate, allowable, and properly allocated.

We recommend that New York Medical College strengthen its internal controls by developing a cost transfer policy that includes the documentation requirements contained in NIH GPS 7.5.

We recommend that New York Medical College strengthen its internal controls by monitoring key individuals' completion of annual FCOI disclosure forms and completion of required FCOI training.

We recommend that the Centers for Medicare & Medicaid Services issue finalized guidance regarding multiple-source physician-administered drugs, to clarify and reinforce the requirement that rebates should be collected for all required physician-administered drugs.

We recommend that the New Mexico Human Services Department recoup the $29,442,388 in NFLOC capitated payments from its MCOs and refund the $20,536,132 Federal share to the Federal Government.